What is the SREP, how intense is it, and what does it decide?

The SREP is the set of processes and measures CySEC uses to make sure CIFs have enough capital for all the material risks their business creates. It has two parts. CySEC reviews and evaluates the firm's ICAAP and strategies and its ability to monitor and meet its own funds requirements. It then imposes supervisory measures where it finds weaknesses in internal controls or risk management, such as extra capital or stronger arrangements. The SREP is CySEC's tool and part of its risk-based supervision. The ICAAP is the firm's own view of the capital it needs, and it is an input to the SREP. Since 5 November 2021, Class 2 CIFs have assessed their internal capital and liquid assets together under section 18 of Law 165(I)/2021, and Class 3 CIFs only if CySEC asks. This does not replace the ICAAP but widens it: the joint EBA and ESMA guidelines call the whole process the ICARAP, made up of an ICAAP for capital and an ILAAP for liquidity, and CySEC's January 2022 practical guide to the IFR and IFD calls it the ICAAP and ILAAP.

The exam material describes the SREP set out in CySEC's 2012 guidelines, Circular C027. Those guidelines were built on Directive 2006/49/EC and Directive 2006/48/EC, and so on the Basel II accord of the Bank for International Settlements. The exam material says the SREP looks up to five years ahead, at both present and future capital needs; C027 itself refers to three to five years. Its guiding principles are that the SREP is risk-based; applies to all CIFs subject to the directive, each of which prepares an ICAAP report; covers all activities and business units, at home and abroad; evaluates business risks and internal governance; assesses the ICAAP's assumptions, method, coverage and outcome; checks other requirements such as large exposures; identifies risks and deficiencies; decides measures; communicates results to management and the board; and is formally reviewed at least once a year, although that review is not a full reassessment.

Since 5 November 2021, Law 165(I)/2021 section 29 has required CySEC to review the arrangements, strategies, processes and mechanisms that Class 2 and Class 3 CIFs use to comply with that Law and the IFR. It evaluates their risks to clients, the market and the firm, the location of exposures, the business model, systemic risk, network and information security risk, interest rate risk outside the trading book, and governance, and it takes into account whether the firm holds professional indemnity insurance. Class 1-minus CIFs are reviewed under Law 97(I)/2021 (section 55), and banks under the banking law. Since 19 June 2023 the joint EBA and ESMA guidelines on the SREP for investment firms have set common procedures. They judge whether the business model is viable over the next 12 months and whether the strategy is sustainable over at least three years.

CySEC sets the frequency and intensity of the review by the firm's size, nature, scale and complexity and, where relevant, its systemic importance. For Class 3 firms, rather than reviewing all CIFs as the exam material says, it decides case by case whether and how to review. Under the guidelines, firms are placed in categories; category 1, for example, includes firms whose total assets and off-balance-sheet exposures reach €1 billion. Key indicators are monitored quarterly, or at least annually for Class 3 firms. All elements are reassessed at least every two years for category 1 and every three years for category 2, and when material new information arises for smaller firms. For CySEC's wider supervisory duties, see What must CySEC do as supervisor, and how does it work with other authorities?.

The exam material says the SREP outcome is the level of capital needed for every risk the CIF faces. That level may be higher than the capital the firm calculated in its own ICAAP, and it becomes the firm's capital requirement. The firm's management is responsible for monitoring its capital against that requirement and for keeping enough capital to meet it. The exam material adds, following C027, that the firm must tell CySEC if its capital is under that requirement or likely to drop under it within the firm's planning horizon. This duty is part of monitoring the SREP outcome, once CySEC has set the requirement. After the SREP, full reviews follow at different intervals for each CIF, depending on its complexity, business, risks and systemic importance, and changes in circumstances are considered at least once a year. A reassessment may come earlier if key assumptions behind the ICAAP change or the risk profile shifts.

Law 165(I)/2021 section 33 now frames the add-on. CySEC may require additional own funds only in the cases the Law lists, such as material risks the IFR requirement does not cover, or weak arrangements that other measures will not fix in time. Where risks are not covered, the add-on is the gap between the capital CySEC considers adequate, after reviewing the firm's internal assessment, and the IFR requirement. At least three quarters of it must be met with Tier 1 capital, and at least three quarters of that with CET1. CySEC may also give capital guidance and set specific liquidity requirements.